Definition
A control pattern that treats giving an AI agent the ability to connect to a tool as a separate decision from letting it actually use that tool. It separates 'which tools can this agent see' from 'what may it do with them,' so access is granted in two controlled steps.
Why it matters
The MCP standard has made it effortless for agents to plug into any internal tool, but that connection is itself a privilege. Two-gate authorization stops an attacker from abusing a wide-open tool connection just because the agent could reach it.